Simple and secure quantum key distribution with biphotons 
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The best qubit one-way quantum key distribution (QKD) protocol can tolerate up to 14.1% in the 
error rate. It has been shown how this rate can be increased by using larger quantum systems. The 
polarization state of a biphoton can encode a three level quantum system - a qutrit. The realization 
of a QKD system with biphotons encounters several problems in generating, manipulating and 
detecting such photon states. We define those limitations and find within them a few protocols 
that perform almost as well as the ideal qutrit protocol. One advantage is that these protocols can 
be implemented with minor modifications into existing single photon systems. The security of one 
protocol is proved for the most general coherent attacks and the largest acceptable error rate for 
this protocol is found to be around 17.7%. This is the first time, to the best of our knowledge, that 
the security of qutrit QKD protocols is rigorously analyzed against general attacks. 
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In order to establish an unconditionally secure commu- 
nication channel between two parties (traditionally called 
Alice and Bob), they have to share a random sequence 
of bits known only to them - a one time pad. Quantum 
key distribution (QKD) is a scheme that exploits the de- 
tails of quantum measurements for generating such a key. 
In the most basic protocol (referred to as BB84 after its 
inventors Bennett and BrassardQ), Alice sends Bob a se- 
ries of two level quantum systems, referred to as qubits. 
The states are randomly chosen from two sets, each of 
them contains two orthogonal states that represent the 
logical zero and one. The two sets relate to each other in a 
mutually-unbiased way, i.e. the probability of measuring 
any particular state when given a state from a different 
set is 1/2. Thus, if Alice chooses to send a state from the 
first set, a measurement in the basis of the other, either 
by Bob or by an eavesdropper (called Eve), will give no 
information about Alice's choice. 

To create the required secret key, a few more steps 
should be carried out through a classical channel, not 
necessarily secured. First, Alice and Bob compare their 
measurement bases and sift only those bits which were 
measured in identical bases. From the remaining key, 
they reveal a portion and compare the results in order 
to estimate the noise parameter. This noise can result 
either from a real physical noise in the channel as well 
as from Eve's measurements. Next, they perform two 
transformations on the key, one to correct for errors and 
the second, called privacy amplification, to reduce the 
amount of mutual information between them and Eve. 

A QKD protocol is characterized by a few parameters. 
The ratio between the number of remaining bits after 
completing this procedure to the number of bits before 
it, is called the rate of the protocol. The merit function 
that characterizes a specific protocol shows its rate as a 
function of the disturbance, the error probability that the 
channel and Eve have created. The higher the critical 
disturbance, where the rate approaches zero, the more 



useful is the protocol. In recent years, the lower bound 
on the critical error rate of BB84 was improved several 
times and the best known result is about 12.4%0. 

The BB84 protocol can be extended in many ways. 
The first simple way is to add an extra base that is 
mutually- unbiased with both others It can be easily 
shown that only one mutually unbiased base (MUB) can 
be added to the BB84 protocol. According to Ref. 0], 
the current critical error rate of this three MUB protocol 
is around 14.1%. Another approach is to use quantum 
systems of higher dimensionality [4]. A three level sys- 
tem can represent a quantum trit (qutrit) and a gen- 
eral d- level system can represent a qudit. A possible 
advantage is the larger number of MUB, up to d -|- 1 
for a d-dimensional protocol^. Previously, generalized 
protocols that use qutrits and higher dimensional quan- 
tum systems have been suggested and their security was 
studiedjl, @]. A potential advantage of improved rates 
for such protocols was shown by examining various at- 
tack schemes0, H H, [13, El El • However, to the best of 
our knowledge, the exact values of the critical error rates 
for qutrit protocols subject to general attacks have never 
been calculated prior to this work. 

There are a few approaches for the realization of more 
than two level quantum systems with light. One is by 
discriminating between modes of different orbital angular 
momentum [l3jjlj|. Another approach is to use several 
spatial modes[l.5| or time bins[16j. A different approach 
that has been studied extensively in recent years is the 
qutrit representation of the polarization state of two in- 
distinguishable photons - a biphoton 17 , l^ • A general 
biphoton state can be written as 



1^2) =ao|2,0)-t-ai|l,l) + a2|0,2). 



(1) 



where |n/i,n„) is a Fock representation of rih (riy) hori- 
zontally (vertically) polarized photons. The general state 
ip2 is represented by a complex vector a — {ao, ai, 02) 
with four degrees of freedom (3 complex numbers less a 
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general phase and normalization). This scheme can be 
also extended to higher dimensions by adding more pho- 
tons, but in this Letter we focus on qutrits. 

There are a few difficulties with generating arbi- 
trary biphoton states [l^ as well as when trying to 
manipulate[2^ and detect them. Optical parametric 
down-conversion (PDC) is the obvious choice as a gener- 
ating scheme, but there are only two types of processes 
available; type I that creates states of the |2, 0) and |0, 2) 
forms, and type II that creates |1, 1) (both in a coUinear 
scheme). If a non-coUinear scheme is used, type I can 
create the |1, 1) type as well. In order to create a gen- 
eral state as in Eq. [U a sensitive interferometer that 
includes both type I and II crystals is required. More- 
over, as we will show later, it is impossible to transform 
efficiently by means of linear optics a state created with 
one PDC process into an arbitrary biphoton state. Fi- 
nally, as transformations are limited, efficient detection is 
only possible for the three basic vectors (the components 
of Eq. [H defined as the 'measurement basis') and their 
available transformations within those limits. Detection 
of a general state is only possible with a beam-splitter 
setup that detects a general state only 1 out of 4 tries. 

In this Letter, we define the subset of biphoton states 
which is easily generated, manipulated and detected. We 
find biphoton QKD protocols within these limits that are 
more secure and efficient than the best single photon pro- 
tocol. Critical error rates are derived for various qutrit 
protocols subject to general attacks, and compared to the 
best possible qutrit protocol of 4 MUB[3|. 

First, we shall define the set of allowed transforma- 
tions. When a biphoton is transmitted through a linear 
optics setup, the polarization state of both of its pho- 
tons experience the same single photon unitary transfor- 
mation. The set of all possible unitary transformations 
on a single photon polarization can be mapped onto the 
Poincare sphere (or the Bloch sphere for a general qubit 
realization), such that U{9,ip) describes the operation 
that transforms the state at the north pole to the coor- 
dinates {0,(p). Thus, if we position the state |1,0) at the 
north pole, a general operation will transform it into 

11(6, ip)\l, 0) = cos(0/2)|l, 0) + sin(0/2)e*'^|O, 1) . (2) 

We name the north pole state as the 'anchor' state and 
the set of U operators as the single photon operations. In 
this single photon case it is trivial to show that whatever 
anchor state is chosen, the U operators will always cover 
the whole single photon polarization space. There are 
a few simple rules to note. A trivial 2t: rotation along 
any great circle will bring any state to itself, while a tt 
rotation will transform any state to its orthogonal state. 
Moreover, a rotation by only 7r/2 along such a path al- 
ways transforms between two mutually unbiased states. 

We shall now find the set of states that can be 
reached by applying U to the biphoton measurement ba- 
sis. Choosing the states |2,0) and |1,1) as the anchors 
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FIG. 1: A top projection from the north pole of an orthogonal 
triplet basis on the |1, 1) dome. The empty circles are states 
identical to their 180° opposites. Four states on this manifold 
are mutually-unbiased to the triplet. These four states are 
not orthogonal between themselves. 

and applying the single photon operations, we get 

Uie, ^)(l, 0, 0) = (cos2(^), i= sin(0)e*^ sin2(^)e2^'^) , (3) 

U{0, ^)(0, 1, 0) = (-i= sin(0), cos(^^)e'^ sm{9)e'''^) ,(4) 

as the new a vectors, respectively. By allowing only two 
parameter operations from a finite set of anchor states, 
we defined a two dimensional subset of the general bipho- 
ton four dimensional space. As the |0,2) state appears 
at the south pole of the sphere defined by the |2, 0) an- 
chor, there is a full overlap between spheres defined by 
these two states. On the other hand, the |1,1) state 
does not appear on the |2, 0) sphere, thus defining a non- 
overlapping sphere that can not be reached from the |2, 0) 
sphere by single photon operations. 

It is possible to identify a few great circle rotation rules 
for the two new spheres, that would be useful later when 
we will look for possible QKD protocols in this subset. 
First, the |2, 0) sphere inherited all of the properties from 
the 1 1,0) single photon sphere. A 2tt rotation returns to 
the original state, a tt rotation transforms between two 
orthogonal states and 7r/2 between two states whose pro- 
jection on each other is 1/2. In the case of the |1,1) 
sphere, there is an interesting difference. The same rules 
still apply, but for half the angles. A tt rotation returns 
to the original state, a 7r/2 rotation transforms between 
two orthogonal states and tt/A between two states whose 
projection on each other is l/\/2- We can identify an or- 
thogonal vector triplet on the |1, 1) sphere as three states 
with 7r/2 in between them. A simple example for such a 
triplet is the |1, 1) state and two 'bunched' states such as 
|2,0) + |2,0) and |2,0) - |2,0)[2i|. Curiously, the state 
which is exactly in the middle of any such triplet (at the 
tetrahedral point, about 54.7° from all the triplet states) 
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FIG. 2: a) The umbrella protocol: two mutually-unbiased 
bases within the single-photon operation subspace. b) The 
three rays protocol: three ray-type bases that are not per- 
fectly mutually-unbiased. 

is mutually unbiased with them (see Fig. [T]). As opposite 
points on the |1,1) sphere are identical, it is enough to 
consider only the upper half of the sphere (a dome) . 

The rotation rules convert the task of finding MUB to 
a packaging problem. Is it possible to pack two triplet 
bases together on the |1, 1) dome and preserve mutually- 
unbiased relationship? By examining Fig. [T]it is easy to 
see that it is impossible. On the other hand, we recog- 
nize a second general type of an orthogonal basis. If we 
position the dome concentrically inside the |2, 0) sphere 
such that both of their north poles point in the same di- 
rection, every ray that passes through the sphere center 
will cut the subspace at three points, two on the sphere 
and one on the dome. This ray triplet contains three or- 
thogonal states. The simplest example is the vertical ray 
that defines the measurement basis. 

We define two possible protocols whose security will be 
checked here. The first protocol has two perfectly MUB 
and the second has three (or more) which are not. Apart 
from the measurement basis which is included in both 
protocols, the additional basis of the first protocol is 

where r = e'^i'^ . Notice how this basis is equivalent to the 
second Fourier basis in Ref. 4] , up to a minus sign at the 
last position. We name this protocol after its umbrella 
shape (see Fig. [2^). The two additional bases of the 
second protocol are of the ray type: 

|i(l,V2,l),i=(l,0,-l),i(l,-V2,l)| , (6) 

|i(l, V2t,-l), -i=(l, 0, 1), i(-l, V2t, 1)| . 

Although the three bases are only close to mutually- 
unbiased, this protocol is appealing because of its symme^ 
try and similarity to the three bases protocol for qubits[3] 
(see Fig. ^jp). Additionally, we considered a protocol 
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FIG. 3: Intercept and resend analysis of a few QKD protocols. 
Qubit protocols are in thin lines - dotted for BB84 and solid 
for the 3 MUB extension. Thick lines are for qutrit protocols - 
dotted, dashed, dot-dashed and solid for the umbrella, 3 rays, 
7 rays and 4 MUB, respectively. 



with 7 ray bases in order to check whether adding rays 
improves the protocol. The 7 rays are the three of the 
previous protocol, plus the four rays through the tetra- 
hedral points (the directions are identical to the 7 solid 
circles in Fig. [T]) 

The simplest eavesdropping attack scheme is the 'in- 
tercept and resend' approach. Showing that a protocol 
is secure against this limited attack does not imply se- 
curity against general attacks. It is only used here for 
comparison between different protocols. We calculated 
Bob and Eve mutual information with Alice with the 
method of Ref. 4] and plotted the difference between 
them as a function of the error rate for a few protocols 
(see Fig. [3]). There is a clear hierarchy between qubit 
and qutrit protocols. The umbrella protocol is better 
than any other using qubits, while the 3 rays protocol 
is even better than the umbrella protocol even though it 
does not include perfectly MUB. As expected, the best 
performance belongs to the 4 MUB protocol, that marks 
the upper limit for any qutrit protocol. Surprisingly, the 
7 rays protocol performs very close to ideal. All critical 
values are much higher than the real limits as this attack 
scheme is far from ideal. 

In order to prove the ultimate security that is required 
from a QKD protocol, we use the general method intro- 
duced in Ref. 0, [l^l • The advantage of this method over 
other previous security proofs is its easy extendability to 
higher dimension while proving security against the most 
general coherent attacks. The scheme results in a convex 
nonlinear optimization problem for every error rate value. 
Here, we only prove unconditional security for the 4 MUB 
and the umbrella protocols as they correspond to simpler 
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a QKD protocol. We suggested a few possible protocols 
within this subspace. The security of these protocols was 
analyzed and compared to standard qubit protocols. A 
large improvement was shown compared to qubits, even 
for the umbrella protocol, which has only two MUB. The 
unconditional security of the umbrella and the 4 MUB 
protocols was proved by extending a previous proof for 
qubits. This is the first time, to the best of our knowl- 
edge, that qutrit protocols have received such a rigorous 
treatment. 

H.S.E. and LB. would like to thank the Israeli Science 
Foundation for supporting this work under grants 366/06 
and 1057/05, respectively. The authors wish to thank B. 
Kol and N. Gisin for helpful discussions. 



FIG. 4: Key generation rate analysis for a general coherent 
attack. Solid (dashed) lines are for calculation with (without) 
noise optimization. Presented results are for 3 qubit and 2 and 
4 qutrit MUB (3x2, 2x3 and 4x3 respectively). 

sets of constraints than the ray protocols. Nevertheless, 
it is only reasonable to assume that as the performance of 
the ray type protocols according to intercept and resend 
analysis is between the 4 MUB and umbrella protocols, 
their performance against general coherent attacks will 
be in this range as well. 

After deriving the constraints, we optimized numer- 
ically the target function (the protocol rate) with the 
CVXOPT convex optimization package [isj. Both pro- 
cedures, with and without noise addition, were calcu- 
lated. The results are plotted in figure|4l For the 3 MUB 
qubit protocol we reproduced the known critical values 
of 14.1% (12.7%) (with and without noise optimization). 
We find proven lower bounds of 17.7% (16.0%), 20.3% 
(18.25%) and 21.1% (19.1%) for the critical error rates 
of the 2 (the umbrella), 3 and 4 MUB qutrit protocols, 
respectively. The 3 qutrit MUB graph is not presented 
here as it can't be realized within the borders of our sub- 
set. These values are considerably higher than the best 
value for qubit protocols to date. Just two MUB gives 
most of the gain between qubits and qutrits, as previ- 
ously suggested by weaker security analvsisflll. [l^. 

We have left open an important issue regarding any 
qutrit protocol with biphotons. Namely, what is the re- 
lation between the single photon (qubit) error rate of 
a certain channel and the qutrit error probability when 
transmitting biphotons? This issue will be addressed in 
a later work. 

In conclusion, we defined the single photon opera- 
tion subspace of the polarized biphoton representation 
of qutrits. This subspace includes states which are easy 
to generate and detect, and thus are easy to implement in 
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